« first day (1869 days earlier)      last day (3309 days later) » 

18:00
@Iszi Nobody bothered to write such a page.
@ThomasPornin I did try implementing DES, TripleDES, and AES 256 before. It worked, but is incredibly slow. I tried to create an encrypted chat client with multiple layers of encryption.
@MarkBuffalo AES is a good option. To understand how to implement it efficiently, you must grasp the underlying mathematics.
Then making a constant-time efficient implementation is the fun part.
@ThomasPornin What kind of math, to those of us who aren't so math-inclined? :b
@Simon I'm sorry you're afraid to ask questions and learn new things :(((( I still love you, though.
The kind of math that counts numbers.
fkin rekt
holy christ pornin wrote an RFC
18:04
lawl
@MarkBuffalo For AES, it's all algebra: finite fields, field extensions, and vector spaces.
@Iszi Out of curiosity, which particular non-SE production of mine did you come across lately ?
0
A: Java SecureRandom doesn't block? How?

ozysNot just to keep an old thread alive but some people might have missed a important part of the long story behind this... It's been about an well known infamous and persistent bug when using /dev/urandom from Java versions 1.4 to versions 1.7. See the links below : http://bugs.java.com/view_bug.d...

^^ good answer, bad answer? i don't know enough about this
@Ohnana Pretty good
neato
18:11
@ThomasPornin I like this one.
@tedder42 see Thomas Pornin (who's truly a genius, btw) here: http://security.stackexchange.com/a/8348http://security.stackexchange.com/a/8348
@ThomasPornin Prior to the RFC you mentioned, we've had discussions not long ago about your SSL configuration checking tool.
@MarkBuffalo waaaaauw
@Xander Nice link, do they make it for men?
I like when @CodesInChaos posts that he disagrees with Thomas in the comments and then they proceed to have a little nurdy war.
@Xander well he failed at pasting the link
Tweeted by kennwhite on October 15, 2014 at 8:24 PM in reply to kennwhite
18:15
@MarkBuffalo you can reply to yourself
quote your own tweet
48
A: What key exchange mechanism should be used in TLS?

Thomas PorninYou may use a key exchange (as part of a cipher suite) only if the server key type and certificate match. To see this in details, let's have a look at cipher suites defined in the TLS 1.2 specification. Each cipher suite defines the key exchange algorithm, as well as the subsequently used symmetr...

that is the link he meant
@ThomasPornin Any others, or just algebra?
accidentally pasted it twice
@MarkBuffalo Dissociative identity disorder.
There is a fan loudly dying on one of our gigabit switches
It's driving me insane
@Simon HAHAHA
18:17
I HAVE A DREAM
THAT MARKUS WILL STOP DELETING EVERY FUCKING POSTS
@Simon Derpy Identity Disorder
@DavidFreitag PHWEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
@Ohnana No it's making more like a random "SCHWAAAWAAAASSHHHHHHHHHWAAAAASHHHHHHSCHWWWAAAAA"
@DavidFreitag pocket sand!
@DavidFreitag Are you sure that it doesn't sound more like "WOOOOOOOOOOAAAAAAAAWWWWWWWWWWWWWWWWWW"?
18:19
@MarkBuffalo Some knowledge of probabilities and statistics helps with understanding cryptanalytic attacks. Some graph theory too.
But really, most of it is algebra.
@Simon I'm quite acutely aware of what it sounds like.
Algebra is a large topic; e.g. it includes elliptic curves.
algebra is a very large topic.
@Ohnana Just like @AviD's mom.
@Simon avid's mum is probably a tiny jewish lady
18:21
@Ohnana Hehehehe.
@Ohnana You're a tiny jewish lady
who has like 5 phd's and kicked ass when she was younger
@Ohnana You have 5 PhD's and kick major ass.
</simons>
... That's not how you do it.
keep practicing, you'll capture the essence eventually
18:22
Delete that.
@Simon You're a delete that.
Yeah, I'm quitting life.
Markus just made me quit life.
is this the chat room of security stackexchange?
People really expect us to be talking about InfoSec 24/7, don't they?
@Simon You're a quitter.
18:27
@AGZuniverse Theoretically, yes.
@AGZuniverse It can be... mostly, we talk about random things, such as Simon's ween... quite unfortunately. He brings it up too much. Well, he'd bring it up if he could.
@AGZuniverse No, this is a chat room specifically devoted to farcical aquatic creatures.
@AGZuniverse yes, except it's about 30% site meta, 20% security, and 50% goofing off
@AGZuniverse Welcome. Please pull up a chair, and begin chatting. Don't leave me cries
18:29
you guys have a sec to check out a vulnerable site?
...uh, no.
I mean, it's like a CTF challenge thingy
@AGZuniverse oh.
gotta get a flag from it
18:30
@AGZuniverse Oh, so you want us to do the CTF for you?
I don't do CTF. They are too artificial.
agdrhil3ektgltrklhdlgklwdehlktrlhklkhdgdklgh
lklrektl34kltkfdslkgldflhklkdflfkdslkdslhlktrwhgadsgfmkvorlewhmdfglhk
I've been trying this for a long time, reaching nowhere
dslgktlwrkhlkwrlmtyqnmtrwlmdfgmkldfkglklskrthkbklghdfkglkllktglker
java auto-updater uninstalled my java development kit for the 10th time in a row
18:31
@MarkBuffalo R.E.K.T.
if one of you could give me like, directions :P
don't use java nooblet
it would be great
@MarkBuffalo I completely removed java from my machine last night
@Ohnana Need it
18:31
@MarkBuffalo These strings are obviously made "randomly" by mashing a keyboard with a human hand.
@AGZuniverse have you heard of the owasp top 10?
@ThomasPornin s/hand/face.
yeah, went through a few things like sql injection etc etc
@ThomasPornin s/hand/genitals
but didn'twork
18:32
@AGZuniverse look at the page source. do you see any interesting pages?
@AGZuniverse I hope you know nobody in this room is foolhardy enough to click that link.
@Ohnana jdk = java development kit. The java updater continually removes my JDK, so I can't run my java code... it's so stupid.
@MarkBuffalo Perhaps the universe is trying to tell you something...
I want to find the person who made this updater and smash their face through a wooden table
@MarkBuffalo the problem is "java"
fix that
18:33
the site allows us to upload a jpeg file when we create an 'account', and then view that image file again when we log in
so I'm assuming shell in an image
but I've tried everything I know and what I found on the web
damn guys that link ain't killing no one :|
@AGZuniverse i managed to just click the login button and log in anonymously
i win c:
I did that too, but no flag
we have to get something like "flag{some_words}
Ok, maybe @Ohnana is foolhardy enough.
@DavidFreitag am in VM
But @Ohnana is a known #yoloswag
18:36
oh and @ohana, in the register page just enter anything random in the email field
no checking
@AGZuniverse does it actually validate that it's an image file?
aka, can you just upload a c99 shell and achieve wins
Agz, when. asking to upload jpeg... what options are there?
it just allows uploading an image file
Do you choose a file name?
Do you choose any parameters?
and if you upload anything other than .jpg/.jpeg, it doesn't allow it through
nope, none
and yeah, the checking's tight
18:38
@MarkBuffalo Upload an AOL cd and all their bases are belong to us
@AGZuniverse can you rename a text file with a .jpg extention
@DavidFreitag I agree. This is the best
totally, yeah
Agz. Try this
I've tried things like shell.php,jpg
18:39
Add code to the jpg file.
Lol.txtmbmp.jpg.exe.vbs.jpg
Xss injection
I added a php line to the comment field of the jpg image and tried
problem is, no matter what, the extension has to be .jpg
18:40
@ThomasPornin o pls
so even when I put php code in it either shows the image or an error (when I just type in php in notepad and save as .jpg)
Break out of the image
if it helps I've tried enough to know the upload doesn't resize or strip exif headers off the image
Break the image tag in html.
Src=""/><?php overflowing my buffalos ?>
hmm...probably should try that.
The processing is done entirely by a server side php script though
and it's a post form client side
18:43
try it anyway
it may go like this:
<img src="lol.jpg"/>
so you could try
<img src="lol.jpg"/><?php aol_cds_haxored(); ?>
This is a good reason to use output sanitation. ho ho
okay so where does that code go?
the image name?
no, inside the image file
specifically somewhere like exif headers or just paste it in
just paste it in
okay. trying it now.
18:46
wait
"/><?php aol_cds_haxored(); ?>
I do not know if that will work...
yeah that's what I'm trying
nope, does not work
Yeah idiot Markus, it doesn't work.
@AGZuniverse Did you escape it properly?
did you actually use aol_cds_haxored();?
i used echo "hello y'all";
any ideas?
maybe I could be wrong and it can be something else other than disguised shell uploading, it's just that uploading and later viewing the image is literally the only thing that can be done on the given site
well did I just kill the whole chat :v
19:04
Just busy at work right now. And now the program is running... so I'm waiting for the results. Now we can chat again.
okay, so any more ideas regarding that?
None that I can test at work
hmmm....anyways, it's like 00:40 over here
sleepy as hell
I'll probably resume my hacking attempts tomorrow evening
will log in over here to see if anyone can help
till then, bye :)
19:39
@ScottPack Well, hopefully work is good busy.
20:02
@RoryAlsop We're a startup so depends on the day. =D
@ScottPack Oh you hipster.
20:21
Best addon ever.
No more browser-fingerprinting with that.
@MarkBuffalo lol sure, and have a bunch of website CSS break spectacularly
I've seen sites to very funky stuff when I used that
@schroeder It's not breaking css
At least not for me
And you can turn that part off
20:39
> If Windows is installed
LOL
/strokes unix beard
strokes long-ass Kylin beard
strokes his stroke
20:41
k
ok bye
yes that is my answer
[citation needed]
I wanna see some citations! Not saying you're wrong, I just want to learn more about it.
www.mobiledit.com/sim-cloning
google is yor friend
@MarkBuffalo i see you editing my shit
20:54
danke. I edited your post with those
:p
i see you
<3
Citations for claims generally result in upvotes from me, especially if sound.
fair enough
@schroeder Do you wanna play not-mod? Or, anyone else who hasn't voted yet wanna play mod?
I'm aware of this, just too lazy to google right now. I've got to focus on work... oh wait, all done today.
20:56
0
Q: If my connection to a website is unencrypted while using Tor is my IP visible?

FinvielI suppose to those of you with technical expertise in this matter this question might seem obvious, so apologies as I am know nothing of this topic. Also what data would be possibly visible by someone potentially monitoring my connection to such a server?

@Iszi Answer is yes if flash or java are running.
And in some cases, Javascript.
If you have any of those, I can force you to reveal your origination
I see you tor user, a thief on the roof. I see your heart beating, I see you are afraid.
@Iszi i voted
already
closed before I could post a proof of concept for it
kek
@Iszi done
Perhaps I should respond to the non-dupe
21:09
@Simon you know I still have abuse mod powers, right?
21:50
@AviD Wait, you're still a mod?
I knoowww, right?
I thought the impeachment proceedings went through
22:03
@DavidFreitag They did. We smothered him in peaches. He rejoiced. We all had a good time.
@MarkBuffalo And you didn't invite me :[
@DavidFreitag We did, you were there... you just forgot because... reasons.
@MarkBuffalo Is that why I was all concussed the other day?
@DavidFreitag Yep, your cussions were conced.
@AviD Why are you saying this?
In reply to what?
22:05
@MarkBuffalo wut
@Simon just in general
the last ping
@DavidFreitag I said you had a concussion. You are flipping out again. You're fading in and out of consciousness.
@DavidFreitag Daaaaaaaaviiiiii
iiiiiid
@AviD Had to stop for breath, huh?
22:06
no, you just passed out for a moment in the middle
try to stay with us, man
quick, somebody get him oxygen!
Oh. Damn. I should go to the
We need to call @DavidFreitag an ambulance.
and steroids!
and a stat!
@DavidFreitag You're an ambulance.
what the hell is a stat, anyway?
22:07
hospital.
@DavidFreitag oopsie, did davie leave a mess on the floor?
@AviD About your mom? I MAKE A JOKE ONCE ABOUT YOUR MOM WHEN YOU CONSTANTLY MAKE MY MOM FAT AND YOU TELL ME THAT?!?!?
@Simon hey now, it's not ME making your mom fat.
;-)
uhh thats a euphemism, right?
...
What's a euphemism?
cuz if it is, then (a) that doesnt make you fat, and (b) very uncool, man.
22:09
MARKUS YOU'VE DELETED AT LEAST 753 MESSAGES TODAY
@MarkBuffalo Not a whole lot of "port" to indulge on though
@Simon lol you makin me larf a lotta today
@AviD Well technically some of the byproducts are filled with proteins
@AviD I meant like, eating actual pork... it's so fatty and stuff.
Good read
22:26
ok bye
@schroeder Nice speed there.
Closed before I could vote duplicate d:
@MarkBuffalo lots of caffeine today
22:40
israeli snacks, if y'all innerested
@AviD Something in http, and not on facebook?
I'm getting MITM'd five times to Sunday here.
Also, Israelites have awesome food :>
nm, can view on phone
cool, I'll check it later. working late tonight

« first day (1869 days earlier)      last day (3309 days later) »